Kurz gesagt
- CVE-2026-61814 ist eine Schwachstelle (HOCH (CVSS 7.5)) in org.typelevel:jawn-parser_2.12, org.typelevel:jawn-parser_2.13, org.typelevel:jawn-parser_3.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.75%, höher als bei 55.0% aller Schwachstellen.
- Abhilfe: auf 1.7.0 oder neuer aktualisieren.
Description
AsyncParser can be forced to perform O(n^2) work on the length of the input. When a single JSON token arrives across many small chunks, each absorb call rescans the incomplete token from the start.
Impact
Denial of service via CPU exhaustion when parsing untrusted JSON.
Preconditions:
- Application uses
AsyncParser
- Attacker can send large tokens with control over chunk sizes.
Patches
Fixed in jawn-parser-1.7.0.
Workarounds
If you can't upgrade immediately:
- Use the synchronous
Parser.
- Buffer incoming bytes into larger chunks before calling
absorb
NVD description
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free